Incident Response / DFIR Analyst

LT Harper Recruitment Group; Greater London; On-site; GBP 111,000 - 166,000; Part time

Job summary

LT Harper Group in London is seeking a hands-on incident response specialist to manage DFIR tasks from detection through containment across client environments. You will guide clients through incidents, coordinate investigations and present findings to stakeholders.

You will map findings to MITRE ATT&CK and contribute to playbooks, threat hunting and post-incident reviews in a contractor, on-site role.

Qualifications

• Investigating incidents with SIEM and EDR/XDR tools
• Analysing Windows and Linux systems, authentication events, network traffic and security logs
• A solid grasp of the incident response lifecycle and frameworks such as MITRE ATT&CK and NIST
• Clear communication with clients and senior stakeholders, and sound judgement under pressure

Responsibilities

• Triage and investigate alerts from SIEM, EDR/XDR, identity, email, cloud and network platforms, then set severity and escalate
• Lead or support investigations into phishing, malware, account compromise, data loss and unauthorised access, coordinating containment and recovery with client stakeholders
• Lead client communications through each incident, giving clear technical guidance and regular updates, then run review meetings to present findings and lessons learned
• Carry out DFIR work across host, network, email and cloud artefacts, maintaining chain of custody and mapping findings to MITRE ATT&CK
• Run intelligence-led threat hunts and build or tune detection content to close gaps found during incidents
• Maintain playbooks and runbooks, run post-incident reviews and support tabletop exercises

Skills

SIEM/EDR analysis

Windows/Linux analysis

Incident response lifecycle

MITRE ATT&CK mapping

Client communication

Tools

Microsoft Defender Suite

Velociraptor

Volatility

EnCase / FTK

Wireshark

Job description

You'll join the incident response team at an MSSP in a hands-on DFIR role, taking incidents across a range of client environments from first alert through containment, digital forensics and lessons learned. You'll also be the person clients turn to during an incident, guiding them through it and presenting what you found once it's resolved.

The essentials

• London, 2 days a week on site
• Contract role, client-facing, working alongside Security Operations, Professional Services and Customer Success teams

What you'll actually do

• Triage and investigate alerts from SIEM, EDR/XDR, identity, email, cloud and network platforms, then set severity and **escalate** against client service levels
• Lead or support investigations into phishing, malware, account compromise, data loss and unauthorised access, coordinating containment and recovery with client stakeholders
• Lead client communications through each incident, giving clear technical guidance and regular updates, then run review meetings to present findings and lessons learned
• Carry out DFIR work across host, network, email and cloud artefacts, maintaining chain of custody and mapping findings to MITRE ATT&CK
• Run intelligence-led threat hunts and build or tune detection content to close gaps found during incidents
• Maintain playbooks and runbooks, run post-incident reviews and support tabletop exercises

What you'll need

• Investigating incidents with SIEM and EDR/XDR tools
• Analysing Windows and Linux systems, authentication events, network traffic and security logs
• A solid grasp of the incident response lifecycle and frameworks such as MITRE ATT&CK and NIST
• Understanding of evidence handling and forensic methodology
• Clear communication with clients and senior stakeholders, and sound judgement under pressure

Nice to have

• Experience in an MSSP, consultancy, financial services, critical infrastructure or other regulated environment
• Microsoft Sentinel, Defender XDR, Defender for Identity or Defender for Cloud
• Scripting or querying in KQL, Python or PowerShell
• Forensic tools such as Velociraptor, Volatility, EnCase, FTK or Wireshark, or certifications such as GCIH, GCFA or SC-200

What's in it for you

Variety. Every client environment is different, and the role covers the whole incident lifecycle, from detection and forensics through to threat hunting, detection engineering and helping shape how the incident response service develops.